exclude assets from auth